Page 28 of 100 — Google CVEs from a corpus of 15879, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26419 | Low | 3.3 | 2025-09-04 | In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2025-22415 | Medium | 4.0 | 2025-09-04 | In android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilege with no additio… |
CVE-2025-22414 | High | 7.8 | 2025-09-04 | In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local esc… |
CVE-2024-49731 | Medium | 4.0 | 2025-09-04 | In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a logic error in the… |
CVE-2024-40664 | Medium | 6.2 | 2025-09-04 | In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logic error in the code… |
CVE-2025-48581 | High | 8.4 | 2025-09-04 | In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could lead to local escalat… |
CVE-2025-48563 | High | 7.8 | 2025-09-04 | In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. This could lead to local escalatio… |
CVE-2025-48562 | Medium | 5.0 | 2025-09-04 | In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This could lead to local information disclosure w… |
CVE-2025-48561 | Medium | 5.5 | 2025-09-04 | In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure. This could lead to local info… |
CVE-2025-48560 | Medium | 5.5 | 2025-09-04 | In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This could lead to local information disclosure w… |
CVE-2025-48559 | Medium | 5.5 | 2025-09-04 | In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denia… |
CVE-2025-48558 | High | 7.8 | 2025-09-04 | In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking. This… |
CVE-2025-48556 | High | 7.3 | 2025-09-04 | In multiple methods of NotificationChannel.java, there is a possible desynchronization from persistence due to improper input validation. This could lead to lo… |
CVE-2025-48554 | Medium | 6.1 | 2025-09-04 | In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the code. This could lead… |
CVE-2025-48553 | High | 7.8 | 2025-09-04 | In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible DoS of a device admin due to a logic error in the code. This could lead to loc… |
CVE-2025-48552 | High | 7.8 | 2025-09-04 | In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to a logic error in the code. This could le… |
CVE-2025-48551 | Medium | 5.0 | 2025-09-04 | In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. This could lead to local infor… |
CVE-2025-48550 | Medium | 5.5 | 2025-09-04 | In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path traversal error. This could lead to local d… |
CVE-2025-48549 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to record audio via a background app due to a missing permission check. This could lead to local escalation of p… |
CVE-2025-48548 | High | 7.3 | 2025-09-04 | In multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the privacy indicator due to a race condition. T… |
CVE-2025-48547 | High | 7.3 | 2025-09-04 | In multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead to local escalation of privilege with n… |
CVE-2025-48546 | High | 7.8 | 2025-09-04 | In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local esca… |
CVE-2025-48545 | High | 7.1 | 2025-09-04 | In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a confused deputy. This could lead to local p… |
CVE-2025-48544 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could lead to local escalation of privilege wit… |
CVE-2025-48543 | High | 8.8 | 2025-09-04 | In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escal… |
CVE-2025-48542 | Medium | 5.5 | 2025-09-04 | In multiple functions of AccountManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denia… |
CVE-2025-48541 | High | 7.8 | 2025-09-04 | In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to… |
CVE-2025-48540 | High | 7.8 | 2025-09-04 | In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a logic error in the code. This could lead to local escalation… |
CVE-2025-48539 | High | 8.0 | 2025-09-04 | In SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after free. This could lead to remote (proximal/adjacent) code execu… |
CVE-2025-48538 | Medium | 5.5 | 2025-09-04 | In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical package due to improper input validation… |
CVE-2025-48537 | High | 7.1 | 2025-09-04 | In multiple locations, there is a possible way to persistently DoS the device due to improper input validation. This could lead to local information disclosure… |
CVE-2025-48535 | High | 7.8 | 2025-09-04 | In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulner… |
CVE-2025-48534 | High | 8.8 | 2025-09-04 | In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to loca… |
CVE-2025-48533 | High | 7.0 | 2025-09-04 | In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. This could lead to local esc… |
CVE-2025-48532 | High | 7.3 | 2025-09-04 | In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a confused deputy. This could lead… |
CVE-2025-48531 | High | 7.8 | 2025-09-04 | In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of p… |
CVE-2025-48530 | High | 8.1 | 2025-09-04 | In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in… |
CVE-2025-48529 | Medium | 5.5 | 2025-09-04 | In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local infor… |
CVE-2025-48528 | Medium | 4.0 | 2025-09-04 | In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lead to local escalation of privilege with… |
CVE-2025-48527 | Medium | 6.2 | 2025-09-04 | In multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the code. This could lead to local information… |
CVE-2025-48526 | Medium | 4.0 | 2025-09-04 | In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper… |
CVE-2025-48524 | Medium | 5.5 | 2025-09-04 | In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local denial of service wi… |
CVE-2025-48523 | High | 7.8 | 2025-09-04 | In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to loca… |
CVE-2025-48522 | High | 7.8 | 2025-09-04 | In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to… |
CVE-2025-32350 | High | 7.8 | 2025-09-04 | In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This coul… |
CVE-2025-32349 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no ad… |
CVE-2025-32347 | High | 7.8 | 2025-09-04 | In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to l… |
CVE-2025-32346 | High | 7.8 | 2025-09-04 | In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This could lead to local… |
CVE-2025-32345 | High | 7.8 | 2025-09-04 | In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app sc… |
CVE-2025-32333 | High | 7.8 | 2025-09-04 | In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in the code. This could lead to local escala… |
CVE-2025-32332 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execu… |
CVE-2025-32331 | High | 7.8 | 2025-09-04 | In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local es… |
CVE-2025-32330 | Medium | 5.7 | 2025-09-04 | In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecure default value. T… |
CVE-2025-32327 | High | 7.8 | 2025-09-04 | In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This could lead to local escalation of privile… |
CVE-2025-32326 | High | 7.8 | 2025-09-04 | In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. This could lead to lo… |
CVE-2025-32325 | High | 7.8 | 2025-09-04 | In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no ad… |
CVE-2025-32324 | High | 7.8 | 2025-09-04 | In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation o… |
CVE-2025-32323 | High | 7.8 | 2025-09-04 | In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popup due to improper… |
CVE-2025-32321 | High | 7.8 | 2025-09-04 | In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local… |
CVE-2025-26464 | High | 7.8 | 2025-09-04 | In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to loca… |
CVE-2025-26454 | High | 7.8 | 2025-09-04 | In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could… |
CVE-2025-22441 | High | 7.3 | 2025-09-04 | In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to… |
CVE-2025-0089 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalation of privilege wi… |
CVE-2025-0076 | Low | 3.3 | 2025-09-04 | In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information… |
CVE-2024-49714 | High | 7.8 | 2025-09-04 | In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device escalation of privil… |
CVE-2025-32312 | High | 7.8 | 2025-09-04 | In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process d… |
CVE-2025-26463 | Medium | 5.5 | 2025-09-04 | In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This could lead to a local persistent denial… |
CVE-2025-26462 | High | 7.8 | 2025-09-04 | In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of… |
CVE-2025-26458 | High | 7.8 | 2025-09-04 | In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to loca… |
CVE-2025-26456 | Medium | 5.5 | 2025-09-04 | In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error in the code. This could lead to local per… |
CVE-2025-26455 | High | 7.8 | 2025-09-04 | In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privi… |
CVE-2025-26453 | Medium | 5.5 | 2025-09-04 | In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. This could lead to loc… |
CVE-2025-26452 | High | 7.8 | 2025-09-04 | In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. This could lead to loc… |
CVE-2025-26450 | High | 7.8 | 2025-09-04 | In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the default IME due to a mi… |
CVE-2025-26449 | Medium | 5.5 | 2025-09-04 | In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additiona… |
CVE-2025-26448 | Medium | 5.5 | 2025-09-04 | In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no… |
CVE-2025-26445 | Medium | 5.5 | 2025-09-04 | In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead to local information… |
CVE-2025-26444 | High | 7.8 | 2025-09-04 | In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant applicat… |
CVE-2025-26443 | High | 7.3 | 2025-09-04 | In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to a logic error in th… |
CVE-2025-26442 | Medium | 5.5 | 2025-09-04 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent filters in NLS due to a logic error in… |
CVE-2025-26441 | Medium | 6.5 | 2025-09-04 | In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no… |
CVE-2025-26440 | High | 7.8 | 2025-09-04 | In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This could lead to local… |
CVE-2025-26438 | High | 8.8 | 2025-09-04 | In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. Th… |
CVE-2025-26437 | Medium | 5.5 | 2025-09-04 | In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing permission check… |
CVE-2025-26436 | High | 7.8 | 2025-09-04 | In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypa… |
CVE-2025-26435 | High | 7.8 | 2025-09-04 | In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app sc… |
CVE-2025-26432 | Medium | 5.5 | 2025-09-04 | In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could lead to local denial of service with no… |
CVE-2025-26430 | High | 7.8 | 2025-09-04 | In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalati… |
CVE-2025-26429 | Medium | 5.5 | 2025-09-04 | In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial of servic… |
CVE-2025-26428 | Low | 3.2 | 2025-09-04 | In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalatio… |
CVE-2025-26427 | Medium | 4.4 | 2025-09-04 | In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privilege with no addition… |
CVE-2025-26426 | Medium | 5.1 | 2025-09-04 | In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper… |
CVE-2025-26425 | Medium | 4.0 | 2025-09-04 | In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local es… |
CVE-2025-26424 | Medium | 4.0 | 2025-09-04 | In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information discl… |
CVE-2025-26423 | Medium | 6.2 | 2025-09-04 | In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to… |
CVE-2025-26422 | Medium | 4.0 | 2025-09-04 | In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could… |
CVE-2025-26421 | Medium | 4.0 | 2025-09-04 | In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additi… |
CVE-2025-26420 | Medium | 4.4 | 2025-09-04 | In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission due to permission ove… |
CVE-2025-22425 | Medium | 5.1 | 2025-09-04 | In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege wit… |
CVE-2025-0087 | Medium | 5.1 | 2025-09-04 | In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to loca… |